* Package name : ssh3 Version : 0.1.4 Upstream Contact: François Michel * URL : https://github.com/francoismichel/ssh3 * License : Apache-2.0 Programming Lang: Go Description : faster and rich secure shell using HTTP/3 SSH3 is a complete revisit of the SSH protocol, mapping its semantics on top of the HTTP mechanisms. In a nutshell, SSH3 uses QUIC+TLS1.3 for secure channel establishment and the HTTP Authorization mechanisms for user authentication. Among others, SSH3 allows the following improvements: - Significantly faster session establishment - New HTTP authentication methods such as OAuth 2.0 and OpenID Connect in addition to classical SSH authentication - Robustness to port scanning attacks: your SSH3 server can be made invisible to other Internet users - UDP port forwarding in addition to classical TCP port forwarding - All the features allowed by the modern QUIC protocol: including connection migration (soon) and multipath connections I hope this package can be maintained in the Debian Go Packaging Team.
Packaging of SSH3 is available here: https://salsa.debian.org/go-team/packages/ssh3 https://salsa.debian.org/jas/ssh3/ Thanks to the Salsa CI/CD pipeline there is an aptly repository available for easy testing, if anyone would like to experiment or help. Below you can find a snippet how you can test the SSH3 client and server via Debian packages, for password and public key authentication, in a safe container using podman. I have only tested this on my laptop that runs Trisquel, but should hopefully be portable. I am delaying upload to Debian for a while to see if upstream reaches a conclusion around naming. I think the name 'ssh3' is unfortunate and distracts from the effort. See: <https://github.com/francoismichel/ssh3/issues/79>. /Simon sudo apt install podman podman run -it --hostname myhost.example --rm debian:unstable cd apt update apt dist-upgrade -y apt install -y ca-certificates echo "deb [trusted=yes] https://salsa.debian.org/jas/ssh3/-/jobs/5094673/artifacts/raw/aptly unstable main" | tee /etc/apt/sources.list.d/ssh3.list apt update apt install -y ssh3 apt install -y ssl-cert # creates snakeoil key/cert passwd # set a test password for 'root' e.g. 'foo' ssh3-server -cert /etc/ssl/certs/ssl-cert-snakeoil.pem -key /etc/ssl/private/ssl-cert-snakeoil.key -enable-password-login -url-path /myurl -v & ssh3 -v -insecure -use-password myhost.example/myurl # type 'foo' at the prompt, and on successful connection type 'exit' to log out apt install -y openssh-client # for ssh-keygen ssh-keygen -t ed25519 -P "" -f /root/.ssh/id_ed25519 cat /root/.ssh/id_ed25519.pub > /root/.ssh3/authorized_identities ssh3 -v -insecure -privkey /root/.ssh/id_ed25519 myhost.example/myurl # on successful connection type 'exit' to log out
I agree - as the Debian OpenSSH maintainer, I'm concerned that this will cause a new source of user confusion because people will think "ah, ssh3, that must be better than ssh" (which indeed seems to have been a deliberate marketing choice by this project) and not realize that it's a largely incompatible thing. Not to mention the way that it parses OpenSSH configuration files, which may work today but I doubt OpenSSH offers any guarantees that it won't make changes that will break this independent parser in future. I also feel that something security-critical like this that's labelled by upstream as "still experimental" probably shouldn't be in a Debian release. Maybe it should be kept in Debian experimental for the time being?
Colin Watson <cjwatson@debian.org> writes: I share these concerns, so I'll delay the upload for now. I'm hoping upstream will rename the project to something less confusing. Sounds good if nothing happens on the naming front in the next weeks/months. Let's wait and see a bit. One alternative that was suggested was to call the package something else in Debian. 'golang-ssh3'? 'go-ssh3'? Still somewhat problematic as long as the 'ssh3' name is in there. /Simon
It is written in Go. The problem of Go library support in Debian should also be considered for a security-critical tool like this. https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#golang-static-linking Regards
Hi Simon, Could you please consider packaging "ssh3" as "soh"? Upstream has already agreed to the rename, it just hasn't been done yet. You wouldn't even need to write the patch yourself, as a pull request performing the rename has been opened already at <https://github.com/francoismichel/ssh3/pull/96>. I think having soh in Debian would be great. Bye!
Hi I also think it would be nice to upload, but upstream didn’t really make a decision as far as I can tell. https://github.com/francoismichel/ssh3/issues/79 Maybe you could explain to upstream that this would get packaged if they did the renaming and a new release? Shipping it as “soh” if that isn’t where upstream is going seems potentially worse than just waiting a bit more to let upstream make some decision. If they already abandoned the project, maybe it doesn’t make sense to package it at all. /Simon
Il giorno gio 6 feb 2025 alle 13:32:44 +01:00:00, Simon Josefsson <simon@josefsson.org> ha scritto: Reading <https://github.com/francoismichel/ssh3/issues/79#issuecomment-1879004877>, I had the impression that the decision was made. But yeah, now that I re-read it I see that the upstream developer doesn't seem that convinced about the rename. He still recommended that name for packagers, though. Makese sense. Doing it now. True. I thought the decision was made, though. This is true as well :) I'll try to leave a comment on the GitHub issue and see what happens. Bye!